I'm vaguely familiar with fuzzing (sending auto-generated malicious input to an API to see if it fails), but there is a big gap between my level of understanding and the level of this document. How do I fill in the gap?

I'd start with reading the libfuzzer docs[0] and then read the syzkaller papers[1]

[0] https://llvm.org/docs/LibFuzzer.html [1] https://github.com/google/syzkaller

https://github.com/google/syzkaller